Is Disk Encryption What It’s Cracked Up To Be?
Disk encryption was introduced as a solution for simplifying the data encryption requirements that most companies face. Now that we’ve gained a few years of experience, we’ve learned that disk encryption is not an all encompassing security solution. Here are a few insights as to why.
One of the more well known security standards, PCI DSS, requires that user profile access to the protected data must be managed separately from the access to the operating system that the data resides on. So for example, if the data is stored on a MS Windows server, access control to the sensitive data must be managed by an application other than in Active Directory. Also, it is required thtat the cryptographic keys and the cardholder data must be secured where ever it may be stored. For example, if the keys or sensitive data is moved on to removable media such as USB drives, CD’s, DVD, or tape backups, it must still be encrypted. Disk encryption does not encrypt data moved to other devices. In order to be compliant with PCI DSS requirements, other encryption methods must be implemented besides disk encryption.
Disk encryption is often used to encrypt laptops and mobile devices that need protection while away from the secured internal network. But we must remember that once out on the unsecured public network, data on encrypted disks is not protected from online hackers who, once they have access to the system, have access to all data on that system.
The disk encryption process takes additional forethought and time for implementation. Drives must be in good condition with no disk errors. It is recommended that each drive be de-fragmented before installing the encryption software. Once the time consuming de-fragmentation task is completed, the encryption process on the drive will take an additional 2 – 4 hours of time to implement depending on the size of the drive. If you are looking at employing this across a large number of laptops in the organization, make sure you have a well thought out and tested action plan that takes into account the impact on the users and their systems.
Experience has shown that a more effective alternative to disk encryption to meet PCI DSS and other similar regulations is to encrypt at the database field level. Although reprogramming and rebuilding your database structure to meet this requirement, there are great third party tools, such as Linoma Software’s Crypto Complete, which provide the perfect solution to this level of encryption without the need to make programming or database changes.






transactions. Businesses can no longer afford the risks of data loss, legal penalties, and damaged business trust when files are stolen or mishandled using the old file transfer protocol to send sensitive information across the internet.
